Top Risks

• Uninstall AND install URL hijack to gameograf.com with UTM tracking — classic monetisation shell.
• NewTab override replaces every new-tab page; combined with search permission enables search-monetisation.
• Privacy policy is generic Google Account policy — does not scope to this extension at all (data_collection+3rd-party_sharing admitted, scope_extension=false → +10.0).
• Free-webmail developer (haluktaze37@gmail.com) with no business domain, no verified publisher.
• Extension contacts major social/media platforms (Instagram, Netflix, YouTube, X) from a wallpaper/NewTab app — unexplained reach.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → gameograf.com with ovkas UTM params; Webstore +3.0.
• install_url_hijack crx onInstalled opens gameograf.com with ovkas UTM params; Webstore +2.0.
• newtab_override manifest chrome_url_overrides.newtab = index.html; scored as MEDIUM perm (+2.0) on Permissions pillar.
• privacy_policy_generic store Policy URL is Google Account policy; scope_extension=false, data_collection=true, 3rd_party=true → Privacy +10.0.
• free_webmail_dev store Developer email haluktaze37@gmail.com, no business website; Reputation +1.5.
• js_external_hosts crx Extension contacts gameograf.com, instagram.com, netflix.com, youtube.com, x.com — 6 external hosts from a wallpaper app.
• no_csp manifest content_security_policy is null/absent on MV3; no v2 +2.0 penalty applied (MV3 strict default).
• search_permission manifest Declared 'search' permission alongside newtab override; enables search-provider manipulation.

Permissions Breakdown

• search medium Allows manipulation of the browser search provider; relevant risk for a NewTab override.
• chrome_url_overrides.newtab high Replaces every new-tab page with extension-controlled content; primary monetisation vector.

Pillar Scores

Bookkeeping